Hi Johannes,
> From: Johannes Berg [mailto:johan...@sipsolutions.net]
> Sent: Wednesday, September 14, 2016 3:25 PM
> To: Bing Zhao; linux-wireless@vger.kernel.org
> Cc: John W. Linville; Amitkumar Karwar; Avinash Patil; Nishant
> Sarmukadam; Frank Huang
> Subject: Re: [PATCH 2/2] mwifiex: parse WMM IEs from hostapd for mwifiex
> AP
>
> Obviously this is a very old patch, but I was just looking at users of
> cfg80211_find_vendor_ie() and realized you have a bug here:
>
> > + vendor_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
> > + WLAN_OUI_TYPE_MICROSOFT_
> > WMM,
> > + params->beacon.tail,
> > + params-
> > >beacon.tail_len);
> > + if (vendor_ie) {
> > + wmm_ie = (struct ieee_types_header *)vendor_ie;
> > + memcpy(&bss_cfg->wmm_info, wmm_ie + 1,
> > + sizeof(bss_cfg->wmm_info));
> > + priv->wmm_enabled = 1;
>
> You need to check that the vendor_ie is actually long enough.
>
Sure. I will prepare a patch to address this.
Regards,
Amitkumar Karwar